CMMC Foundation study plan

Map the CMMC ecosystem's key components - DoD, the CMMC Accreditation Body (now ISACA/CMMC-AB transition context), assessment organizations, and the training/credentialing pipeline - into a one-page diagram from memory

Sequence the historical timeline from DFARS 252.204-7012 through the interim rule to CMMC 2.0, noting what changed between 1.0 and 2.0

Distinguish the three CMMC levels by the security requirement source each draws from and the assessment type each requires

Define Level 1, Level 2, and Level 3 in your own words and check each definition against the official model documentation

Walk through all 14 domains of the CMMC model and state the purpose of each without notes

Identify which practices belong to Level 1 versus added at Level 2, and which NIST SP 800-171 requirements map to each domain

Explain the difference between a self-assessment and a C3PAO-led certification assessment, including who is eligible for each

Describe the scoring methodology for Level 2 assessments, including how conditional certification and POA&Ms affect outcomes

Trace how a Level 2 assessment is scoped, including which assets and enclaves are in scope and how the boundary is documented

Explain the POA&M process: what can and cannot be placed on a POA&M, timelines, and the conditions for conditional status

Diagram the assessment lifecycle from scheduling through the C3PAO's final report to the affirmation in SPRS

Summarize how assessment results are recorded in SPRS and what a supplier's score means to a prime contractor

Differentiate the roles of C3PAO, Certified Assessor, Registered Practitioner, and Registered Practitioner Organization, and state what each is authorized to do

Explain the requirements and conflict-of-interest rules a C3PAO must satisfy to assess an organization

Describe the instructor and curriculum approval pathway for CMMC training, including who authorizes it

Practice explaining the assessment process aloud to a non-technical colleague in under five minutes

Outline the steps an organization takes to prepare for a C3PAO assessment, from gap analysis through evidence collection

Describe how a defense contractor selects and engages a C3PAO, including independence and scheduling considerations

Explain what a prime contractor must do to flow down CMMC requirements to subcontractors and how that affects the supply chain

Identify common pitfalls that cause assessment delays or failures

Explain how CMMC requirements appear in solicitations and contracts, and which DFARS clauses trigger them

Describe the SPRS scoring system and how a score is calculated and maintained

Map the marketplace of CMMC service providers: consultants, MSPs, RPOs, and C3PAOs, and how they differ

Analyze a hypothetical small defense contractor's situation and recommend a path to compliance

Review all four domains using spaced repetition and identify your three weakest subtopics

Create 20 practice questions across all domains and answer them without notes

Re-explain the CMMC 1.0 to 2.0 changes and the three levels from memory

Walk through the full assessment lifecycle end-to-end from memory in under ten minutes

Close remaining knowledge gaps identified in week 7

Complete a timed full-length practice exam under test conditions

Review every missed question and write a one-sentence correction for each

Confirm exam-day logistics and finalize a one-page summary sheet of key facts